Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Postfix - antispam and relay package

    pfSense Packages
    136
    855
    881.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • marcellocM
      marcelloc
      last edited by

      @mschiek01:

      Jul 27 15:14:50 pfsense postfix/postfix-script[16474]: warning: not owned by postfix: /var/db/postfix/./2012-04-25.db
      Jul 27 15:14:50 pfsense postfix/postfix-script[17029]: warning: not owned by postfix: /var/db/postfix/./2012-04-26.db
      Jul 27 15:14:50 pfsense postfix/postfix-script[17082]: warning: not owned by postfix: /var/db/postfix/./2012-05-02.db
      Jul 27 15:14:50 pfsense postfix/postfix-script[17087]: warning: not owned by postfix: /var/db/postfix/./2012-05-03.db
      Jul 27 15:14:50 pfsense postfix/postfix-script[17153]: warning: not owned by postfix: /var/db/postfix/./2012-05-11.db

      You can ignore these warnings.
      These db files are the log files for mail search gui tab. Postfix complaint about it because it's on postfix db dir.

      About the perl version, pfsense package forces version 5.12.4 but multiple perl version still need some checks/attention.

      att,
      Marcello Coutinho

      note: Just to get easier to read the forum, prefer using [ code ] instead of [ quote ] when you need to include some logs on post.  ;)

      Treinamentos de Elite: http://sys-squad.com

      Help a community developer! ;D

      1 Reply Last reply Reply Quote 0
      • E
        eri--
        last edited by

        Marcello,

        since i was going through the package today, allow me some improvement comments.

        • Recipients (Get recipients from AD), can't this be integrated with the 2.0 Server manager?
            There is all the code you need there!
        • Access Lists, can't you make an alias like interface so its easy to integrate and for consistency?
        • Just hid the complexity of postfix in the GUI and make it simple mail proxy? Look at endian for example for user interface guidelines.

        Just my 2 cents.

        1 Reply Last reply Reply Quote 0
        • marcellocM
          marcelloc
          last edited by

          Thanks ermal,

          I'll take a look on this since I finish modsecurity and varnish3 new gui version.

          att,
          Marcello Coutinho

          Treinamentos de Elite: http://sys-squad.com

          Help a community developer! ;D

          1 Reply Last reply Reply Quote 0
          • I
            ics
            last edited by

            Hi,

            I've noticed that when a server is blocked because of its presence in a DNSBL, it is not logged in sqlite files.
            We can only see that it has been blocked in maillog.

            Is there a way to view it in search mail ?

            Could  we send logs to external syslog and keep track in sqlite ?

            Thanks

            1 Reply Last reply Reply Quote 0
            • M
              mrfairsquare
              last edited by

              I'm reposting here, as i think it's a better location than as it's own lonesome thread here –> http://forum.pfsense.org/index.php/topic,52293.0.html
              –-

              Hello to all who read this. After many days investigating and chewing on this particular issue, i have reached the conclusion, i need help... HELP!

              ISSUE:
              –-----
              The postfix log db file is empty, and postfix does not or can not write to the db file.

              Location i'm looking at:  /var/db/postfix

              TRIED SO FAR:
              –-------------
              1. Initially i found an error on line 54 when running this: /usr/local/bin/php -q /usr/local/www/postfix.php 01min - I fixed that, by changing the sync setting to "disabled", as was set to something else. So now it outputs just fine.

              2. I made sure that sqlite was installed, by using the touch command as in an earlier post. -
              "touch /etc/php_dynamodules/pdo
              touch /etc/php_dynamodules/pdo_sqlite"

              3. Discovered differences in permission in the /var/db/postfix folder, and attempted setting any any rules on file and folder permissions to no success or noticable effect, since reverted back to previous permissions.

              4. Increased debugging level to 6, in an attempt to get more information.

              5. Can find no errors or notable problems when using: # tail -f /var/log/mailog

              6. Deleting the db files, restarting postfix and recieving a test e-mail to trigger a new db file.

              7. Ensured set as follows: "Choose how often pfSense will transfer log files to Sqlite database.
              To use Diagnostics -> Search mail you need to:
              Select Loggin Destination to /var/log/maillog
              Select update Sqlite frequency
              Inlcude /^Subject:/ WARN line in Acl Headers after all your Subject rules. "

              –-------------------
              PROCESS INVOLVED:
              –-------------------
              This is the flow of what happens:

              1. New e-mail comes in and shows in tail -f /var/log/maillog
              2. If not already created, a db file is created for the current day in the /var/db/postfix folder
              3. DB is created at 38,912 bytes.
              4. 5 more e-mails come in, DB is still 38,912 bytes.

              THEORY:
              –-------
              Postfix is not writing data to the log file, therefore either sqlite issue or permissions.

              If anyone can help you'll be making me a very happy man, possibly enough to add a little spring in my step.  ;D

              VERSION:
              –--------
              2.0.1-RELEASE (i386)
              FreeBSD pfsense-vm.***.com 8.1-RELEASE-p6 FreeBSD 8.1-RELEASE-p6

              Peace. x

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                @ics:

                I've noticed that when a server is blocked because of its presence in a DNSBL, it is not logged in sqlite files.
                We can only see that it has been blocked in maillog.

                Is there a way to view it in search mail ?

                Did you tried to search it on noqueue ?

                @ics:

                Could  we send logs to external syslog and keep track in sqlite ?

                Not on current package version.

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • I
                  ics
                  last edited by

                  @marcelloc:

                  @ics:

                  I've noticed that when a server is blocked because of its presence in a DNSBL, it is not logged in sqlite files.
                  We can only see that it has been blocked in maillog.

                  Is there a way to view it in search mail ?

                  Did you tried to search it on noqueue ?

                  Of course I did  :)

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    "touch /etc/php_dynamodules/pdo
                    touch /etc/php_dynamodules/pdo_sqlite"

                    current package version use sqlite version2, so no need to enable pdo_sqlite.

                    you have selected update every minute, as well selected subject warn on access lists?

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • M
                      mrfairsquare
                      last edited by

                      Hi Marcel,

                      I can confirm that i have settings set to update every minute and configured subject warn on access lists.

                      1 Reply Last reply Reply Quote 0
                      • U
                        Unubtanium
                        last edited by

                        I have two strange problems and hope someone can help to point me in the right direction of the solution to it!

                        Here goes:
                        On Page:   In Services -> Postfix forwarder -> Access List (both problems are related to this page)

                        NR1: In the box/field Sender i have entered an email like this on its on line: info@club108.co.uk REJECT
                        BUT                         still on the 18th aug i got an email from them:

                        
2012-08-18 15:01:28	Mail.Info	LANIP	Aug 18 15:05:41 postfix/postscreen[55280]: CONNECT from [216.75.30.240]:56243
2012-08-18 15:01:28	Mail.Info	LANIP	Aug 18 15:05:41 postfix/postscreen[55280]: PASS OLD [216.75.30.240]:56243
2012-08-18 15:01:28	Mail.Info	LANIP	Aug 18 15:05:41 postfix/smtpd[55431]: connect from mail.zoneedit.com[216.75.30.240]
2012-08-18 15:01:28	Mail.Info	LANIP	Aug 18 15:05:42 postfix/smtpd[55431]: 148B811D31: client=mail.zoneedit.com[216.75.30.240]
2012-08-18 15:01:28	Local0.Info	LANIP	Aug 18 15:05:42 pf: 00:00:32.461734 rule 27/0(match): pass in on de0: (tos 0x0, ttl 49, id 16506, offset 0, flags [DF], proto TCP (6), length 60)
2012-08-18 15:01:28	Local0.Info	LANIP	Aug 18 15:05:42 pf:     216.75.30.240.56243 > WANIP.25: Flags [s], cksum 0xdc33 (correct), seq 1302170047, win 5840, options [mss 1460,sackOK,TS val 3096627653 ecr 0,nop,wscale 7], length 0
2012-08-18 15:01:28	Mail.Info	LANIP	Aug 18 15:05:42 postfix/cleanup[56044]: 148B811D31: warning: header Subject: CLUB 108 from mail.zoneedit.com[216.75.30.240]; from= <user29223@lws05.ldn5.groupnbt.net>to= <my@email.com>proto=ESMTP helo= <mail.zoneedit.com>2012-08-18 15:01:28	Mail.Info	LANIP	Aug 18 15:05:42 postfix/cleanup[56044]: 148B811D31: hold: header From: Club 108 <info@club108.co.uk>  from mail.zoneedit.com[216.75.30.240]; from= <user29223@lws05.ldn5.groupnbt.net>to= <my@email.com>proto=ESMTP helo= <mail.zoneedit.com>2012-08-18 15:01:28	Mail.Info	LANIP	Aug 18 15:05:42 postfix/cleanup[56044]: 148B811D31: message-id= <e1t2jem-0008eb-m2@lws05.ldn5.groupnbt.net>2012-08-18 15:01:28	Mail.Info	LANIP	Aug 18 15:05:42 postfix/smtpd[55431]: disconnect from mail.zoneedit.com[216.75.30.240]
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:42 MailScanner[61380]: New Batch: Scanning 1 messages, 1769 bytes
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:42 MailScanner[61380]: Filename Checks: Allowing 148B811D31.ACD2F msg-61380-1.txt
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Filetype Checks: Allowing 148B811D31.ACD2F msg-61380-1.txt
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Virus and Content Scanning: Starting
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Virus Scanning completed at 6753 bytes per second
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Spam Checks: Starting
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: SpamAssassin cache hit for message 148B811D31.ACD2F
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Message 148B811D31.ACD2F from 216.75.30.240 (user29223@lws05.ldn5.groupnbt.net) to evensen-it.com is not spam, SpamAssassin (cached, score=1.989, required 6, DKIM_ADSP_NXDOMAIN 0.80, RCVD_IN_DNSWL_NONE -0.00, UPPERCASE_75_100 1.19)
2012-08-18 15:01:29	Mail.Notice	LANIP	Aug 18 15:05:43 MailScanner[61380]: Delivery of nonspam: message 148B811D31.ACD2F from user29223@lws05.ldn5.groupnbt.net to my@email.com with subject CLUB 108
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Spam Checks completed at 75498 bytes per second
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Requeue: 148B811D31.ACD2F to 52D8711D36
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Uninfected: Delivered 1 messages
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Virus Processing completed at 10632 bytes per second
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 postfix/qmgr[42867]: 52D8711D36: from=<user29223@lws05.ldn5.groupnbt.net>, size=1084, nrcpt=1 (queue active)
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Deleted 1 messages from processing-database
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Batch completed at 3563 bytes per second (1769 / 0)
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Batch (1 message) processed in 0.50 seconds
2012-08-18 15:01:30	Mail.Info	LANIP	Aug 18 15:05:43 postfix/smtp[61179]: 52D8711D36: to=<my@email.com>, relay=MailServerLanIP[MailServerLanIP]:25, delay=1.6, delays=1.4/0/0.01/0.23, dsn=2.6.0, status=sent (250 2.6.0 <e1t2jem-0008eb-m2@lws05.ldn5.groupnbt.net> [InternalId=218] Queued mail for delivery)
2012-08-18 15:01:30	Mail.Info	LANIP	Aug 18 15:05:43 postfix/qmgr[42867]: 52D8711D36: removed

SO my question is, how can i make SURE that it uses my sender rules or is it using it but the email is not in the from field and 
this email info@club108.co.uk are presented in the header because this a forwarded email and i have to put this email in the MIME filed/box?

And NR2:

I have entered this domain in CIDR box/field on its own line: 
[b] venus.aleo.no OK[/b]

But when i check the log  see this??
[code]
postfix/postscreen[30282]: warning: cidr map /usr/local/etc/postfix/cal_cidr, line 4: bad address pattern: "venus.aleo.no": skipping this rule
[/code]

But in the description for the CIDR it says that i can use a domain but is this wrong? 
Because the IPs i have entered there are all oki?

Thanks to reading.. 

  ;D[/s]</e1t2jem-0008eb-m2@lws05.ldn5.groupnbt.net></my@email.com></user29223@lws05.ldn5.groupnbt.net></e1t2jem-0008eb-m2@lws05.ldn5.groupnbt.net></mail.zoneedit.com></my@email.com></user29223@lws05.ldn5.groupnbt.net></info@club108.co.uk></mail.zoneedit.com></my@email.com></user29223@lws05.ldn5.groupnbt.net>
                        1 Reply Last reply Reply Quote 0
                        • L
                          louis-m
                          last edited by

                          if you are using 2.1_x64, your gui config could show you one thing while postfix is doing another thing due to where it reads it's config from.
                          i don't think the package has been updated for 2.1_x64 yet if that's what you are using.
                          every time i do an upgrade of pfsense_x64, i have to copy /usr/local/etc/postfix to /usr/pbi/postfix-amd64/etc/postfix and then it works.

                          1 Reply Last reply Reply Quote 0
                          • U
                            Unubtanium
                            last edited by

                            Thanks for the heads up louis-m, but i am using 2.0.1 Release i386 .

                            1 Reply Last reply Reply Quote 0
                            • U
                              Unubtanium
                              last edited by

                              And one last question!  8)
                              how or why are an ip that are in a RBL being PASS NEW and not just automatically dropped after it is confirmed that the ip is on a rbl to save resources ?????????????

                              
postfix/postscreen[8038]: DISCONNECT [190.167.194.178]:64340
postfix/postscreen[8038]: PASS NEW [190.167.194.178]:64340
postfix/postscreen[8038]: HANGUP after 2.2 from [190.167.194.178]:64340 in tests after SMTP handshake
postfix/postscreen[8038]: NOQUEUE: reject: RCPT from [190.167.194.178]:64340: 450 4.3.2 Service currently unavailable; from=<services@us-ups.com>, to=<novalidrecipients@domain.com>, proto=SMTP, helo= <us-ups.com>postfix/dnsblog[50328]: addr 190.167.194.178 listed by domain b.barracudacentral.org as 127.0.0.2
pf:     190.167.194.178.64340 > WANIP.25: Flags [s], cksum 0xf8f6 (correct), seq 5162395, win 8192, options [mss 1260,nop,nop,sackOK], length 0
postfix/postscreen[8038]: CONNECT from [190.167.194.178]:64340

[/s]</us-ups.com></novalidrecipients@domain.com></services@us-ups.com>
                              1 Reply Last reply Reply Quote 0
                              • V
                                voona
                                last edited by

                                Anyone? What permissions am i meant to use?

                                ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check permissions!).
ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).
                                1 Reply Last reply Reply Quote 0
                                • U
                                  Unubtanium
                                  last edited by

                                  @voona:

                                  Anyone? What permissions am i meant to use?

                                  ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check permissions!).
ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).

                                  I did not even have this file when i did a fresh install so i created the file and just gave it rw-rw-rw-, maby not the smartest to do but it works.. and it is only my clamlog..  ;D

                                  1 Reply Last reply Reply Quote 0
                                  • V
                                    voona
                                    last edited by

                                    Ok Clamd seems to be running now but im having issues with mail scanner actually enforcing the policy

                                    For example i set the maximum attachment size to 0 (Blocking any attachments) and mail still flows through Postfix without being scanned / processed by mail scanner

                                    
Aug 30 10:08:13 	postfix/postscreen[3173]: CONNECT from [209.85.210.178]:38820
Aug 30 10:08:13 	postfix/postscreen[3173]: PASS OLD [209.85.210.178]:38820
Aug 30 10:08:13 	postfix/smtpd[3358]: connect from mail-iy0-f178.google.com[209.85.210.178]
Aug 30 10:08:14 	postfix/smtpd[3358]: 770AC739A6: client=mail-iy0-f178.google.com[209.85.210.178]
Aug 30 10:08:14 	postfix/cleanup[3948]: 770AC739A6: message-id= <canygpjxck1vxv3szxtdz-vm-e8hqbjas5b3wtnnfvtvub_hjoq@mail.gmail.com>Aug 30 10:08:15 	postfix/qmgr[3429]: 770AC739A6: from=<xxxxxxxxxxxxxxx@gmail.com>, size=130538, nrcpt=1 (queue active)
Aug 30 10:08:16 	postfix/smtp[4255]: 770AC739A6: to=<xxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxxxxxxxxxxx.com.au>, relay=10.100.100.2[10.100.100.2]:25, delay=2.2, delays=2/0.02/0/0.23, dsn=2.6.0, status=sent (250 2.6.0 <canygpjxck1vxv3szxtdz-vm-e8hqbjas5b3wtnnfvtvub_hjoq@mail.gmail.com>[InternalId=27] Queued mail for delivery)
Aug 30 10:08:16 	postfix/qmgr[3429]: 770AC739A6: removed
Aug 30 10:08:45 	postfix/smtpd[3358]: disconnect from mail-iy0-f178.google.com[209.85.210.178]</canygpjxck1vxv3szxtdz-vm-e8hqbjas5b3wtnnfvtvub_hjoq@mail.gmail.com></xxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxxxxxxxxxxx.com.au></xxxxxxxxxxxxxxx@gmail.com></canygpjxck1vxv3szxtdz-vm-e8hqbjas5b3wtnnfvtvub_hjoq@mail.gmail.com> 

                                    
Aug 30 10:09:59 	check_reload_status: Syncing firewall
Aug 30 10:09:59 	check_reload_status: Syncing firewall
Aug 30 10:10:00 	php: /pkg_edit.php: Restarting clamav-clamd daemon
Aug 30 10:10:07 	php: /pkg_edit.php: Restarting dccifd
Aug 30 10:10:07 	dccifd[56724]: 1.3.140 detected 0 spam, ignored for 0, rejected for 0, and discarded for 0 targets among 0 total messages for 5 targets since 08/30/12 10:00:13
Aug 30 10:10:07 	dccifd[15470]: 1.3.140 listening to /usr/local/dcc/dccifd for ASCII protocol
Aug 30 10:10:07 	php: /pkg_edit.php: Restarting MailScanner
Aug 30 10:10:11 	MailScanner[28826]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:11 	MailScanner[28826]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:11 	MailScanner[28826]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:11 	MailScanner[28826]: Using SpamAssassin results cache
Aug 30 10:10:11 	MailScanner[28826]: Connected to SpamAssassin cache database
Aug 30 10:10:11 	MailScanner[28826]: Enabling SpamAssassin auto-whitelist functionality...
Aug 30 10:10:16 	MailScanner[29081]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:16 	MailScanner[29081]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:16 	MailScanner[29081]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:16 	MailScanner[29081]: Using SpamAssassin results cache
Aug 30 10:10:16 	MailScanner[29081]: Connected to SpamAssassin cache database
Aug 30 10:10:16 	MailScanner[29081]: Enabling SpamAssassin auto-whitelist functionality...
Aug 30 10:10:21 	MailScanner[37257]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:21 	MailScanner[37257]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:21 	MailScanner[37257]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:21 	MailScanner[37257]: Using SpamAssassin results cache
Aug 30 10:10:21 	MailScanner[37257]: Connected to SpamAssassin cache database
Aug 30 10:10:21 	MailScanner[37257]: Enabling SpamAssassin auto-whitelist functionality...
Aug 30 10:10:26 	MailScanner[44670]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:26 	MailScanner[44670]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:26 	MailScanner[44670]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:26 	MailScanner[44670]: Using SpamAssassin results cache
Aug 30 10:10:26 	MailScanner[44670]: Connected to SpamAssassin cache database
Aug 30 10:10:26 	MailScanner[44670]: Enabling SpamAssassin auto-whitelist functionality...
Aug 30 10:10:31 	MailScanner[52918]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:31 	MailScanner[52918]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:31 	MailScanner[52918]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:31 	MailScanner[52918]: Using SpamAssassin results cache
Aug 30 10:10:31 	MailScanner[52918]: Connected to SpamAssassin cache database
Aug 30 10:10:31 	MailScanner[52918]: Enabling SpamAssassin auto-whitelist functionality...


                                    
postfix 28643  0.0  1.9 21916 19280  ??  Is   10:10AM   0:00.01 MailScanner: master waiting for children, sleeping (perl5.12.4)
postfix 28826  0.0  5.0 63832 51228  ??  S    10:10AM   0:02.13 MailScanner: waiting for messages (perl5.12.4)
postfix 29081  0.0  5.0 63832 51228  ??  S    10:10AM   0:02.14 MailScanner: waiting for messages (perl5.12.4)
postfix 37257  0.0  5.0 63832 51272  ??  S    10:10AM   0:02.16 MailScanner: waiting for messages (perl5.12.4)
postfix 44670  0.0  5.0 63832 51272  ??  S    10:10AM   0:02.23 MailScanner: waiting for messages (perl5.12.4)
postfix 52918  0.0  5.0 63832 51228  ??  S    10:10AM   0:02.17 MailScanner: waiting for messages (perl5.12.4)

                                    I have ticked the use 3rd Party Anti-Spam box in the postfix configuration. Anyone got a quick run through guide to get this setup and working properly ?

                                    1 Reply Last reply Reply Quote 0
                                    • U
                                      Unubtanium
                                      last edited by

                                      @voona:

                                      Ok Clamd seems to be running now but im having issues with mail scanner actually enforcing the policy

                                      For example i set the maximum attachment size to 0 (Blocking any attachments) and mail still flows through Postfix without being scanned / processed by mail scanner

                                      
Aug 30 10:08:13 	postfix/postscreen[3173]: CONNECT from [209.85.210.178]:38820
Aug 30 10:08:13 	postfix/postscreen[3173]: PASS OLD [209.85.210.178]:38820
Aug 30 10:08:13 	postfix/smtpd[3358]: connect from mail-iy0-f178.google.com[209.85.210.178]
Aug 30 10:08:14 	postfix/smtpd[3358]: 770AC739A6: client=mail-iy0-f178.google.com[209.85.210.178]
Aug 30 10:08:14 	postfix/cleanup[3948]: 770AC739A6: message-id= <canygpjxck1vxv3szxtdz-vm-e8hqbjas5b3wtnnfvtvub_hjoq@mail.gmail.com>Aug 30 10:08:15 	postfix/qmgr[3429]: 770AC739A6: from=<xxxxxxxxxxxxxxx@gmail.com>, size=130538, nrcpt=1 (queue active)
Aug 30 10:08:16 	postfix/smtp[4255]: 770AC739A6: to=<xxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxxxxxxxxxxx.com.au>, relay=10.100.100.2[10.100.100.2]:25, delay=2.2, delays=2/0.02/0/0.23, dsn=2.6.0, status=sent (250 2.6.0 <canygpjxck1vxv3szxtdz-vm-e8hqbjas5b3wtnnfvtvub_hjoq@mail.gmail.com>[InternalId=27] Queued mail for delivery)
Aug 30 10:08:16 	postfix/qmgr[3429]: 770AC739A6: removed
Aug 30 10:08:45 	postfix/smtpd[3358]: disconnect from mail-iy0-f178.google.com[209.85.210.178]</canygpjxck1vxv3szxtdz-vm-e8hqbjas5b3wtnnfvtvub_hjoq@mail.gmail.com></xxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxxxxxxxxxxx.com.au></xxxxxxxxxxxxxxx@gmail.com></canygpjxck1vxv3szxtdz-vm-e8hqbjas5b3wtnnfvtvub_hjoq@mail.gmail.com> 

                                      
Aug 30 10:09:59 	check_reload_status: Syncing firewall
Aug 30 10:09:59 	check_reload_status: Syncing firewall
Aug 30 10:10:00 	php: /pkg_edit.php: Restarting clamav-clamd daemon
Aug 30 10:10:07 	php: /pkg_edit.php: Restarting dccifd
Aug 30 10:10:07 	dccifd[56724]: 1.3.140 detected 0 spam, ignored for 0, rejected for 0, and discarded for 0 targets among 0 total messages for 5 targets since 08/30/12 10:00:13
Aug 30 10:10:07 	dccifd[15470]: 1.3.140 listening to /usr/local/dcc/dccifd for ASCII protocol
Aug 30 10:10:07 	php: /pkg_edit.php: Restarting MailScanner
Aug 30 10:10:11 	MailScanner[28826]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:11 	MailScanner[28826]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:11 	MailScanner[28826]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:11 	MailScanner[28826]: Using SpamAssassin results cache
Aug 30 10:10:11 	MailScanner[28826]: Connected to SpamAssassin cache database
Aug 30 10:10:11 	MailScanner[28826]: Enabling SpamAssassin auto-whitelist functionality...
Aug 30 10:10:16 	MailScanner[29081]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:16 	MailScanner[29081]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:16 	MailScanner[29081]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:16 	MailScanner[29081]: Using SpamAssassin results cache
Aug 30 10:10:16 	MailScanner[29081]: Connected to SpamAssassin cache database
Aug 30 10:10:16 	MailScanner[29081]: Enabling SpamAssassin auto-whitelist functionality...
Aug 30 10:10:21 	MailScanner[37257]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:21 	MailScanner[37257]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:21 	MailScanner[37257]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:21 	MailScanner[37257]: Using SpamAssassin results cache
Aug 30 10:10:21 	MailScanner[37257]: Connected to SpamAssassin cache database
Aug 30 10:10:21 	MailScanner[37257]: Enabling SpamAssassin auto-whitelist functionality...
Aug 30 10:10:26 	MailScanner[44670]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:26 	MailScanner[44670]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:26 	MailScanner[44670]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:26 	MailScanner[44670]: Using SpamAssassin results cache
Aug 30 10:10:26 	MailScanner[44670]: Connected to SpamAssassin cache database
Aug 30 10:10:26 	MailScanner[44670]: Enabling SpamAssassin auto-whitelist functionality...
Aug 30 10:10:31 	MailScanner[52918]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:31 	MailScanner[52918]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:31 	MailScanner[52918]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:31 	MailScanner[52918]: Using SpamAssassin results cache
Aug 30 10:10:31 	MailScanner[52918]: Connected to SpamAssassin cache database
Aug 30 10:10:31 	MailScanner[52918]: Enabling SpamAssassin auto-whitelist functionality...


                                      
postfix 28643  0.0  1.9 21916 19280  ??  Is   10:10AM   0:00.01 MailScanner: master waiting for children, sleeping (perl5.12.4)
postfix 28826  0.0  5.0 63832 51228  ??  S    10:10AM   0:02.13 MailScanner: waiting for messages (perl5.12.4)
postfix 29081  0.0  5.0 63832 51228  ??  S    10:10AM   0:02.14 MailScanner: waiting for messages (perl5.12.4)
postfix 37257  0.0  5.0 63832 51272  ??  S    10:10AM   0:02.16 MailScanner: waiting for messages (perl5.12.4)
postfix 44670  0.0  5.0 63832 51272  ??  S    10:10AM   0:02.23 MailScanner: waiting for messages (perl5.12.4)
postfix 52918  0.0  5.0 63832 51228  ??  S    10:10AM   0:02.17 MailScanner: waiting for messages (perl5.12.4)

                                      I have ticked the use 3rd Party Anti-Spam box in the postfix configuration. Anyone got a quick run through guide to get this setup and working properly ?

                                      Have a look here:
                                      http://forum.pfsense.org/index.php/topic,43687.0.html
                                      There might be some info there that might help.

                                      1 Reply Last reply Reply Quote 0
                                      • R
                                        RobinGill
                                        last edited by

                                        @ics:

                                        @marcelloc:

                                        @ics:

                                        I've noticed that when a server is blocked because of its presence in a DNSBL, it is not logged in sqlite files.
                                        We can only see that it has been blocked in maillog.

                                        Is there a way to view it in search mail ?

                                        Did you tried to search it on noqueue ?

                                        Of course I did  :)

                                        I'm getting the same issue here.

                                        The only way of me detecting these events is to packet capture port 25 on WAN and then manually look through it.

                                        Edit: looking through /var/log/mailog is much easier than capturing port 25 on WAN

                                        1 Reply Last reply Reply Quote 0
                                        • Z
                                          zlyzwy
                                          last edited by

                                          Hi Marcelloc,

                                          I unchecked "Helo Hostname" in antispam page, but it seems that the postfix is still reject the mail from unknown host.

                                          RCPT from unknown[114.251.18.30]: 450 4.7.1 Client host rejected: cannot find your hostname, [114.251.18.30]

                                          I've already restart the PF once so I think the setting should be applied.

                                          thanks for any advice.

                                          Zlyzwy

                                          1 Reply Last reply Reply Quote 0
                                          • marcellocM
                                            marcelloc
                                            last edited by

                                            @zlyzwy:

                                            I unchecked "Helo Hostname" in antispam page, but it seems that the postfix is still reject the mail from unknown host.

                                            RCPT from unknown[114.251.18.30]: 450 4.7.1 Client host rejected: cannot find your hostname, [114.251.18.30]

                                            The helo check verifies the helo info, the log you sent is the host check. The best way is to ask remote admin to fix his dns or if you trust remote domain insert his dns on pfsense dns overide or include this host on my_network.

                                            Treinamentos de Elite: http://sys-squad.com

                                            Help a community developer! ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post